Qilin

Qilin, a threat actor known for its malicious activities in the cyberspace, has been on the rise with an increase in victim count by 44% reaching 140 in Q3. This group is part of the Octo Tempest group which recently added RansomHub and Qilin ransomware to its arsenal, enhancing its capabilities to launch more sophisticated attacks. Notably, Qilin has demonstrated its potency through a successful attack on automotive giant Yanfeng using its namesake ransomware. Furthermore, researchers have discovered a new variant of the Qilin ransomware, dubbed Qilin.B, that exhibits advanced encryption techniques and enhanced defense evasion capabilities, targeting both Windows and Linux systems for double extortion schemes. Qilin's operations are multifaceted and often involve partnerships with initial access brokers (IABs) to execute their attacks. In one observed case, the Qilin ransomware gang breached its target via a VPN portal, demonstrating their advanced tactics. Despite this, the group has not been without setbacks. The rise of RansomHub seems to have come at the expense of LockBit, which had three times more successful attacks than Qilin in the second quarter. However, the fortunes of Qilin appear to be improving as they continue to expand their reach and improve their tactics. The group has also faced legal challenges. In August, Synnovis obtained a preliminary injunction from the English High Court against the Qilin ransomware group, Telegram, and a leak site to prevent the publication of stolen data. Following this injunction, Telegram blocked the channel used by Qilin to leak the data stolen from victims. Despite these obstacles, Qilin continues to pose a significant threat, as evidenced by an incident in June where the group published stolen data on its Tor leak site. As such, organizations must remain vigilant and proactive in their cybersecurity efforts to counteract the evolving threat posed by Qilin.